# socials — PII gate

The gate runs for every `piiBearing` subject ([`sources.md`](sources.md)): `bespoke`
unless the operator declares the material brand-safe. It runs **before** anything
reaches a template — over every candidate image and every copy fact. `microsite`
skips it (the site is already published copy).

Detection is the agent's own visual and textual review against the taxonomy below
plus operator confirmation. No computer-vision model ships; the operator-approval
gate is the backstop. The skill **never posts** — the bundle is for review.

## Text never emitted

"Rendered-tile copy" means **every** text field that reaches a tile or a caption:
the headline and sub (from the candidate set), the eyebrow, the four spec tags
(`copyFacts.specs[]`), and every platform caption. The gate reviews all of them.

No caption and no rendered-tile copy may contain:

- the **client name** (person or company),
- the **site address or postcode** (or any fragment that identifies the address),
- any **contract, invoice, or payment figure** — any currency amount, any
  percentage that reveals a financial position,
- any **named individual** (worker, client, neighbour, surveyor),
- any **email sender** address or name lifted from an instruction email.

The work is the story. "New studio open on the high street" is publishable.
"Invoice 3 for the Smiths at 14 Mill Lane, £42,310 due" is not.

## Photos that are rejected

Reject a candidate image (do not crop around it — reject the whole photo) if it
shows:

- a recognizable **face**,
- a **vehicle number plate**,
- a **house number, street sign, or nameplate**,
- **visible client paperwork** — a letter, an invoice, a drawing with a title block,
  a screen showing client data.

A photo of the work itself — a finished space, a product, a completed project —
with none of the above is usable.

## The redaction report

Every `piiBearing` run writes `redaction-report.md` to the output. It reconciles
**every** source photo and **every** source text field to one disposition:

- **used** — appears in the bundle (which tile / caption),
- **redacted** — the source carried PII that was removed before use (name the field
  and what was stripped),
- **rejected** — not used at all (name the reason: which photo category, which text
  rule).

The report is the standing reconciliation that makes a silent leak visible: a source
PII field that appears in an output but is absent from the report's redacted/rejected
list is the failure signature. A **missing or empty report is itself a failure** —
the skill refuses to present a bundle without it.

## When every photo is rejected

If vetting rejects every candidate image, stop and ask the operator for a usable
photo. Never emit an imageless bundle, and never fall back to a stock or invented
image — the report shows all photos *rejected* and no tile is written.